DeepL: translate and write with AI

What This Extension Does

The DeepL: translate and write with AI extension appears to be a productivity tool that allows users to translate text while reading or writing, utilizing the DeepL Translate service.

Permissions Explained

• activeTab: Allows the extension to access the currently active tab in the browser.

+ Standard for translation extensions.

• storage: Enables the extension to store data locally on the user's device.

+ Common for extensions that need to remember user settings or cache data.

• contextMenus: Grants permission to create custom context menus within the browser.

+ Unusual, but possible for an extension with a complex UI.

• tabs: Allows the extension to interact with tabs in various ways (e.g., creating new tabs, accessing tab metadata).

+ Standard for extensions that need to manage multiple tabs or windows.

• scripting: Enables the extension to execute scripts within web pages.

+ Unusual, but possible for an extension that needs to inject custom JavaScript into web pages.

• declarativeNetRequest: Allows the extension to modify network requests made by the browser.

+ Standard for extensions that need to intercept or modify HTTP requests.

• identity: Grants permission to access user identity information (e.g., username, email).

+ Unusual, but possible if the extension needs to authenticate with a service using the user's credentials.

• tts (Text-to-Speech): Enables the extension to use the browser's text-to-speech functionality.

+ Standard for extensions that provide accessibility features or read aloud functionality.

• alarms: Allows the extension to schedule periodic tasks or alarms.

+ Unusual, but possible if the extension needs to perform background tasks at specific intervals.

• webRequest: Grants permission to intercept and modify web requests made by the browser.

+ Standard for extensions that need to inspect or modify HTTP traffic.

• cookies: Enables the extension to access and manage cookies set by websites.

+ Unusual, but possible if the extension needs to authenticate with a service using cookie-based authentication.

• sidePanel: Allows the extension to create a side panel within the browser.

+ Standard for extensions that need to provide additional UI features.

What We Found in the Code

• [medium] innerHTML assignment — potential XSS vector: This flag is likely due to the use of innerHTML for rendering dynamic content. While this can be a security risk if used with untrusted data, it's also a common pattern in web development for rendering UI elements.
• [info] Makes HTTP requests: This is expected behavior for an extension that communicates with a remote service (DeepL Translate).
• [high] Listens to keyboard events: This flag suggests the extension may be using keyboard listeners for shortcuts or other purposes. While this can be unusual, it's also possible if the extension needs to provide complex UI interactions.

External Connections

The extension communicates with the following domains:

• www.deepl.com (expected)
• w.deepl.com (expected)
• api.deepl.com (expected)
• support.deepl.com (expected)
• write-pro.www.deepl.com (unexpected, possibly a testing or development domain)
• write-free.www.deepl.com (unexpected, possibly a testing or development domain)
• deepl.qualtrics.com (unexpected, possibly for survey or feedback purposes)
• addons.mozilla.org (unexpected, possibly for Mozilla-specific functionality)
• s.deepl.com (unexpected, possibly a subdomain used for specific services)
• auth.deepl.com (expected)

Things to Consider

Based on the extension's name and description, it appears that the permissions declared are generally consistent with its intended functionality. However, some permissions (e.g., scripting, alarms) seem broader than necessary for a translation-focused extension.

Users may want to consider whether the extension's access to user identity information (identity permission) is justified by its stated purpose. Additionally, the use of keyboard listeners and potential XSS vector via innerHTML assignment warrant closer examination of the extension's code and behavior.